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(54) Title: REGISTRY EMULATION 

(57) Abstract: A method for running a software application on a computer having an operating system that provides a local database 
containing consistent configuration data to be accessed by programs running on the computer. The method includes providing a file 
Q containing further configuration data required by the application, which further data are not stored in the local database. A request 
by the application to access the local database is intercepted, and an item of the further configuration data is returned from the file to 
the application, responsive to the request. 
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REGISTRY EMULATION 



CROSS-REFERENCE TO RELATED APPLICATIONS 

This application claims the benefit of U.S. Serial Number 09/528,582 filed March 20, 
2000 which claims priority to U.S. Provisional Patent Application Serial No. 60/188,155 entitled 
"Registry Emulation/ 5 filed March 9, 2000, both of which are assigned to Exent Technologies 
5 LTD., and which are incorporated herein by reference. 

FIELD OF THE INVENTION 

The present invention relates generally to computer application software, and specifically 
to methods and system enabling application software to run on a computer with installation. 

BACKGROUND OF THE INVENTION 

10 The registry is a system-defined database, which is included as a part of Microsoft 

Windows 3.1 and later Windows operating systems. It is used by applications and other system 
components to store and retrieve consistent configuration data. Information regarding the 
registry and its use is provided in publications available from the Microsoft Developers' 
Network (MSN) of Microsoft Corporation, Redmond, Washington, including "Platform SDK: 

1 5 Performance Monitoring/Registry," and Chapter 23 (Registry) of the "Driver Development Kit." 
These publications are incorporated herein by reference. Data in the registry can be manipulated 
using application program interface (API) functions and services described in the above- 
mentioned publication, as well as with a Windows utility called the Registry Editor 
(Regedit.exe). Registry-related services are normally carried out by the Virtual Machine 

20 Manager (VMM) component of the Windows operating system kernel 

The registry stores data in a hierarchically-structured tree. Each node in the tree is called 
a key. Each key can contain both subkeys (which are themselves keys) and data entries called 
values. When an application is installed on a computer running Windows, it typically stores its 
own registry data in a branch under a key that is created for the particular application. In 

25 addition, the application may also use subkeys and values that are stored under other keys, which 
are shared with the operating system and/or with other applications. While the application is 
running, it uses the names of the appropriate keys to navigate in the registry for the purpose of 
reading and writing configuration data. Without the configuration data, the application is unable 
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to run. For this reason, installation is an indispensable preparatory step to running most 
Windows application that are known in the art. 

During the installation procedure, the application creates any necessary new keys and 
writes the values that it will require in the registry. To add a new key or value to the registry, the 
application must first open an existing key, typically using the RegOpenKeyEx function (or a 
corresponding service RegOpenKey), as described in the above-mentioned documentation. 
After creating a new subkey or setting a new value, the key is closed, and the new data are 
written to the registry. A group of keys, subkeys and values belonging to a specified branch of 
the registry may be saved to a backup file, known as a hive file, using the RegSaveKey function, 
as described in the above-mentioned MSDN documentation. Subsequently, the RegLoadKey 
function can be used to recall the information from the hive file and to restore it to the registry in 
a specified location. When the hive file contains data used by an application, it must be loaded 
back into the registry before the application can run. 

SUMMARY OF THE INVENTION 

It is an object of some aspects of the present invention to provide methods for enabling a 
software application to run on a computer without installation. 

It is a further object of some aspects of the present invention to provide tools for 
emulating functions of the Windows registry. 

In preferred embodiments of the present invention, a computer running a Windows 
operating system, and thus having a local registry, initiates running of a software application 
without installing on the computer. Instead, registry information needed for the application is 
provided in a previously-created emulation hive file. The data in the hive file are loaded into the 
local registry at a predetermined location before the application begins to run. When the 
application attempts to access the registry, by invoicing an appropriate key as specified by the 
application designer, a registry emulation function intercepts the application's request. The 
emulation function determines whether the key is located in the local registry or is taken from 
the data in the emulation hive file. Based on this determination, the emulation function services 
the request. The registry emulation is transparent to the application and to the operating system, 
so that the application runs as though it was actually installed on the computer. 

In some preferred embodiments of the present invention, the application software and 
hive file are stored on a server, which is accessed by the computer via a network, such as the 
Internet. The registry emulation feature enables the computer to run the application without a 
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user of the computer having to spend the time and effort required to download and install the 
entire application. Typically, only the hive file and required portions of the application are 
downloaded. Preferably, configuration changes made by the user while the application is 
running are saved in the emulation hive file when the computer exits from the application. The 
5 next time the user accesses this application, the hive file enables the saved configuration to be 
restored immediately. The local registry on the computer is substantially unaffected, however. 

In some preferred embodiments of the present invention, the emulation hive file is 
created by actually installing the application on a trial computer, and intercepting requests by the 
application to write data to the registry during installation. A list is maintained of the keys 
10 created or used by the application during installation. The keys and their values are preferably 
arranged in a special branch of the registry of the trial computer that is created for this purpose, 
which mirrors the actual locations of the keys in the registry as used by the installation process. 
Upon the conclusion of installation, the special branch is saved, thus creating the emulation hive 
file. 

15 Although preferred embodiments described herein are based on the registry of the 

Windows operating system, the principles of the present invention are similarly applicable to 
other operating systems that use a common database to maintain consistent configuration data for 
different applications. 

There is therefore provided, in accordance with a preferred embodiment of the present 
20 invention, a method for running a software application on a computer having an operating 

system that provides a local database containing consistent configuration data to be accessed by 
programs running on the computer, the method including: 

providing a file containing further configuration data required by the application, which 
further data are not stored in the local database; 
25 intercepting a request by the application to access the local database; and 

returning an item of the further configuration data from the file to the application, 
responsive to the request. 

Preferably, the database includes a hierarchical database having a tree structure that 
includes a plurality of branches, and providing the file includes providing data corresponding to 
30 one or more branches of the tree structure that are used by the application. Further preferably, 
the operating system includes a Windows operating system, and the database includes a 
Windows registry, and providing the data includes providing one or more registry keys, wherein 
intercepting the request includes hooking a registry service request. Most preferably, hooking 
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the registry service request includes identifying one of the keys in the request, and processing the 
request responsive to the identified key. Further preferably, providing the file includes providing 
a hive file, and loading the data from the file into the registry before running the application. 

Preferably, intercepting the request includes making a determination whether the request 
5 relates to one of the branches that contains only the further configuration data, or whether the 
request relates to another of the branches that is shared with the database, and processing the 
request responsive to the determination. 

Additionally or alternatively, intercepting the request by the application includes 
receiving a request to alter the further configuration data, and the method includes altering the 
1 0 data in the file responsive to the request. Preferably, the method further includes saving the file 
including the altered data upon termination of the application, to be used in running the 
application subsequently. 

Preferably, returning the item of the further configuration data includes emulating access 
by the operating system to the database, so that the request is handled in a manner transparent to 
15 the application. 

In a preferred embodiment, the further configuration data include data that would 
normally be written to the database in the course of installation of the application on the 
computer, and running the software application includes running the application substantially 
without installation on the computer, by using the data in the file. 
20 There is also provided, in accordance with a preferred embodiment of the present 

invention, a method for running a software application on a computer without installation of the 
application thereon, under an operating system that provides a local database containing 
consistent configuration data to be accessed by programs running on the computer, which 
configuration data would normally include installation data generated during the installation of 
25 the application, the method including; 

providing a file containing the installation data, which are not stored in the local 
database; and 

accessing the data in the file instead of accessing the local database so as to retrieve the 
installation data while running the application. 
30 Preferably, the method includes receiving the file and the application by download over a 

network to run on the computer. Further preferably, accessing the data includes providing the 
installation data from the file in a maimer that emulates access by the operating system to the 
database, whereby the data are accessed in a manner transparent to the application. 
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In a preferred embodiment, providing the file includes collecting the installation data 
responsive to installing the application on a trial computer. 

There is additionally provided, in accordance with a preferred embodiment of the present 
invention, a method for generating an emulation file for use in running a software application on 
5 a user computer under an operating system that provides a local database containing consistent 
configuration data to be accessed by programs running on the user computer, which 
configuration data would normally include installation data generated during installation of the 
application on the user computer, the method including; 

installing the application on a trial computer; 
10 intercepting a request generated while installing the application to write the installation 

data to the database on the trial computer; and 

responsive to the intercepted request, writing the installation data to the emulation file, to 
be accessed by the application running on the user computer in place of accessing the local 
database, whereby the application runs on the user computer without installation thereon. 
1 5 Preferably, writing the installation data includes saving one or more registry keys in a 

hive file. Most preferably, saving the one or more registry keys in the hive file includes creating 
an emulation branch in the registry that mirrors locations at which the one or more keys are 
stored in the registry during the installation on the trial computer, and saving the emulation 
branch in the hive file. 

20 There is further provided, in accordance with a preferred embodiment of the present 

invention, computer apparatus having an operating system that provides a local database 
containing consistent configuration data to be accessed by programs running on the apparatus, 
which apparatus is adapted to receive a tile containing further configuration data required by an 
application, which further data are not stored in the local database, and to run an application 

25 under the operating system by intercepting requests made by the application to access the 

database and to return, responsive to the requests, items of the further configuration data from 
the file to the application. 

There is moreover provided, in accordance with a preferred embodiment of the present 
invention, computer apparatus for running a software application under an operating system that 

30 provides a local database containing consistent configuration data to be accessed by programs 
running on the computer, which configuration data would normally include installation data 
generated during installation of the application on the apparatus, which apparatus is adapted to 
receive a file containing the installation data, which are not stored in the local database, and to 
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run the application without the installation of the application on the apparatus by retrieving the 
installation data from the file instead of accessing the local database. 

There is furthermore provided, in accordance with a preferred embodiment of the present 
invention, apparatus for generating an emulation file for use in running a software application on 
5 a user computer under an operating system that provides a local database containing consistent 
configuration data to be accessed by programs running on the user computer, which 
configuration data would normally include installation data generated during installation of the 
application on the computer, the apparatus including a trial computer on which the application is 
installed, which trial computer is adapted to intercept requests, generated while installing the 
10 application, to write the installation data to the local database on the trial computer, and which 
trial computer is further adapted, responsive to the intercepted requests, to write the installation 
data to the emulation file, to be accessed by the application running on the user computer in 
place of accessing the local database, whereby the application runs on the user computer without 
installation thereon. 

15 There is also provided, in accordance with a preferred embodiment of the present 

invention, a computer software product for enabling a software application to run on a computer 
having an operating system that provides a local database containing consistent configuration 
data to be accessed by programs running on the computer, the product including a 
computer-readable medium in which program instructions are stored, which instructions, when 

20 read by the computer, cause the computer to receive a file containing further configuration data 
required by the application, which further data are not stored in the local database, and to 
intercept a request by the application to access the local database, so as to return an item of the 
" further configuration data to the application, responsive to the request. 

There is additionally provided, in accordance with a preferred embodiment of the present 

25 invention, a computer software product for enabling a software application to run on a computer 
without installation of the application on the computer, under an operating system that provides a 
local database containing consistent configuration data to be accessed by programs running on 
the computer, which configuration data would normally include installation data generated 
during the installation of the application on the computer, the product including a computer- 

30 readable medium in which program instructions are stored, which instructions, when read by the 
computer, cause the computer to read a file containing the installation data, which installation 
data are not stored in the database, and to access the data in the file instead of accessing the local 
database so as to retrieve the installation data while running the application. 
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There is further provided, in accordance with a preferred embodiment of the present 
invention, a computer software product for generating an emulation file for use in running a 
software application on a user computer under an operating system that provides a local database 
containing consistent configuration data to be accessed by programs running under the operating 
5 system, which configuration data would normally include installation data generated during 
installation of the application, the product including a computer-readable medium in which 
program instructions are stored, which instructions, when read by a trial computer, cause the trial 
computer to intercept a request generated to write the installation data to the database while the 
application is being installed on the trial computer, and responsive to the intercepted request, to 
1 0 write the installation data to the emulation file, to be accessed by the application running on the 
user computer instead of accessing the local database, whereby the application runs on the user 
computer without installation thereon. 

The present invention will be more fully understood from the following detailed 
description of the preferred embodiments thereof, taken together with the drawings in which: 

1 5 BRIEF DESCRIPTION OF THE DRAWINGS 

v 

Fig. 1 is a block diagram that schematically illustrates a system for running computer 
software applications without installation thereof, in accordance with a preferred embodiment of 
the present invention; 

Fig. 2A is a graph that schematically shows details of a local registry database, as is 
20 known in the art; 

Fig. 2B is a graph that schematically shows details of an emulation registry database, in 
accordance with a preferred embodiment of the present invention; 

Fig. 2C is a graph that schematically shows details of a combined registry database, in 
accordance with a preferred embodiment of the present invention; 
25 Fig. 3 is a flow chart that schematically illustrates a method for registry emulation, in 

accordance with a preferred embodiment of the present invention; and 

Fig. 4 is a flow chart that schematically illustrates a method for creating an emulation 
hive file, in accordance with a preferred embodiment of the present invention. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

30 Fig. 1 is a block diagram that schematically illustrates a system 20 for running software 

applications without installation on a computer 21, in accordance with a preferred embodiment 
of the present invention. Computer 21, preferably comprises a personal computer (PC) running a 
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Microsofl Windows operating system. The computer has a disk memory 22 which stores 
operating system files 24 and a local Windows registry 26, as well as other data 28. Computer 
21 is linked to a server 32, preferably via a network 30, such as the Internet. A disk memory 34 
of the server stores its own operating system files 36, along with an executable application 
5 program file 3 8 and a hive file 40 associated with the application program. The hive file is used 
to supplement the data in local registry 26, enabling the application to run on computer 21 
without installation as described hereinbelow. 

Fig. 2 A is a graph that schematically illustrates details of registry 26, in accordance with 
conventions of the Windows operating system. The registry comprises a tree-structured database 

10 having a root 41 and a number of predefined keys at the root, including a 

HKEYJLOCAL_MACHINE key 43. This latter key conventionally leads to a branch of the 
tree holding configuration data regarding hardware and software that are installed in computer 
21. Typically, the software configuration data are stored under a software subkey 44, which 
itself contains subkeys such as a "MYFILES" subkey 46 and vendor subkeys 50. All of these 

15 subkeys generally contain further subkeys, such as subkeys 48 corresponding to particular file 
types under subkey 46, as well as values (not shown in this figure). The elements of registry 26 
and their locations in the registry database are shown in Fig. 2A only by way of example. 
Windows imposes relatively few constraints on application developers, who may thus choose to 
define different keys and locations in the registry in which to store their configuration data. 

20 Fig. 2B is a graph that schematically illustrates details of an emulation registry database 

52, in accordance with a preferred embodiment of the present invention. The figure presents a 
hypothetical example of a database created to hold registry emulation data for two applications, 
"GAME A" and "GAME B," belonging to an application vendor named "RMAT." For this 
purpose, an emulation key 54 is preferably created under HKEY_LOCAL_MACHINE key 43, 

25 most preferably using "registry spying" procedures described hereinbelow with reference to Fig. 
4. The contents of database 52 are stored in hive file 40. When the hive file is loaded, 
preferably using the RegLoadKey function of the above mentioned Microsoft Platform SDK, key 
54 is added to the tree of registry 26 in its designated location under 

HKEYJLOCAL_MACHINE key 43. Alternatively, the emulation key may be created elsewhere 
30 in the registry tree, as long as its location is such as to allow the hive file with the emulation key 
to be created. 

Emulation key 54 contains subkeys and branches that correspond to the subkeys and 
branches of local registry 26. These are typically the subkeys and branches to which application 
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38 would write its configuration data if the application were actually installed on computer 21 . 
Thus, database 52 comprises a second HKEY_LOCAL_MACHINE key 56 under emulation key 
54, with its own software subkey 44 and MYFILES subkey 46 corresponding to the software and 
file type subkey s in local registry 26. Subkey 46 in database 52 contains a further subkey 58 
5 corresponding to a new file type "hij" used by the RMAT applications. Database 52 also 

comprises a vendor subkey 60 for RMAT, containing configuration data and values required for 
the vendor's games. 

Fig. 2C is a graph that schematically shows details of a combined registry database 64, 
which is presented by a registry emulation function to application 38 running on computer 21, in 

10 accordance with a preferred embodiment of the present invention. Combined database 64 is 

created from local registry 26 and emulation database 52. It corresponds to the registry structure 
that application 38 would encounter on disk 22 if the application were installed there. Database 
64, however, is a sort of virtual database, since there is nowhere that it is stored as an integrated 
unit in this form. Rather, the emulation function running in conjunction with the application on 

15 computer 21 provides pieces of the database dynamically, in reply to requests by the application 
to access the registry. The method by which the emulation database is combined with the local 
registry is described hereinbelow with reference to Fig 3. The result is that the registry 
emulation is transparent to the application, which runs as though it were installed on the 
computer. 

20 Combined database 64 includes some keys that are purely local (belonging only to 

registry 26), others that are used only by the registry emulation, and still others that are shared 
between local and emulation functions. For example, vendor subkeys 50 are pure local keys, 
while vendor subkey 60 is a pure emulation key. On the other hand software subkey 44 and 
MYFILES subkey 46 are shared, appearing in both registry 26 and emulation database 52. 

25 When the application invokes such a shared key, the emulation process preferably refers to both 
the local registry and the emulation database in order to service the application. When the 
application changes one of the shared keys or values, the change is preferably recorded in the 
emulation database, without changing the local registry itself. Thus, when the application is 
finished running, the computer will return to its previous configuration, as given by its local 

30 registry. 

Fig. 3 is a flow chart that schematically illustrates a method for running an application 
with registry emulation, in accordance with a preferred embodiment of the present invention. At 
a connection step 70, computer 21 connects to server 32 and, at an application request step 72, 
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invokes application 38. In response, the server pro vides the necessary application code and hive 
file 40. At a load step 74, the contents of the hive file (database 52) are loaded into the registry 
of computer 2 1 , preferably using the above-mentioned RegLoadKey function. 

Registry emulation is initiated using database 52 and registry 26, at a start emulation step 
5 75. The emulation is carried out by a Windows Virtual Device Driver (VxD), which includes the 
necessary functions to intercept and service registry requests made by application 38. Methods 
of building and loading VxDs are known in the art of Windows programming. For example, 
tools and procedures for compiling, linking, loading and debugging VxDs are provided by 
VtoolsD (available from Compuware Numega, http://www.numega.com/). The use of these 

10 tools is described in Chapter 5 of the VtoolsD User 's Guide, which is incorporated herein by 
reference. The VxD that is used for emulation is preferably pre-installed on disk 22 of computer 
21, and is loaded dynamically at step 75. Alternatively, the VxD may be downloaded from 
server 32 for installation on computer 21 at this stage. Loading of the VxD is preferably 
accomplished by calling the appropriate Windows API or service. These APIs and services are 

1 5 described in MSDN publications including "Platform SDK: Win32 API" and Chapter 36 
(Virtual-Device Loader) of the "Driver Development Kit," which are incorporated herein by 
reference. Alternatively, VtoolsD provides a utility known as VXDLOAD that can be used for 
this purpose. Upon completion of the emulation (at step 84, below), the VXD is preferably 
unloaded. 

20 The application begins to run on computer 21, at an application running step 76. 

Whenever the application requests one of the registry services provided by the Windows VMM, 
an appropriate function of the registry emulation VxD intercepts, or "hooks" the request, at a 
hooking step 78. Preferably, the following services are hooked: 

■ RegOpenKey 
25 ■ RegCloseKey 

■ RegQueryValue 

■ RegQueryValueEx 

■ RegCreateKey 

■ RegDeleteKey 
30 ■ RegSetValue 

RegSetValueEx 

■ RegEnumKey 

■ RegEnumValue 
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■ RegQuerylnfoKey 

Any suitable tools may be used for this purpose, such as the HookJDeviceJService_C service, 
also provided by VtoolsD. This service enables emulation functions to monitor and replace the 
services of the VMM with substitute services. Details of these substitute services are described 
5 in Appendix A. 

Every registry request made by the application must specify a registry key to which the 
request refers. To deal with these requests, the registry emulation functions build and maintain a 
list of all open registry keys, referred to herein as the key list. In the Windows operating system, 
each open key is assigned a unique handle, which is preferably used to identify the key in the 

10 list. The key list can be implemented as an array or a linked list. Preferably, the key list is 

maintained in memory as a binary-sorted array (sorted by the handles), so that the emulation runs 
efficiently and does not slow the application. A new record is added to the key list whenever 
RegopenKey or RegCreateKey is called. 

In addition to the handle, the following information is preferably collected and held for 

15 each key in the list: 

■ The path to the key. 

■ The number of subkeys that exist under this key in registry 26, referred to herein 
as the maximum key index. 

■ The number of values that exist under this key in registry 26, referred to herein as 
20 the maximum value index. 

■ A flag indicating whether or not the key exists in registry 26, preferably having 
the value true if the key exists only in emulation database 52 (i.e., a pure emulation key), 
and false if it exists in registry 26. 

■ An additional key handle, referred to herein as the parallel key. 

25 Beyond the path and the handle, the other fields in the key list are useful in enhancing the 

efficiency and speed of the emulation functions. Not all of these fields need be used, and some 
may be blank. Further details regarding the use of this information are provided in Appendix A. 

For each registry request received from the application, the registry emulation VxD finds 
the corresponding key in the key list, at a key finding step 80. Then, at a servicing step 82, the 

30 emulation provides the application with the requested service. In order to provide for emulation 
of all of the registry services that the application may request, the emulation VxD and key list 
must support the following functions: 

■ Add a key to the list. 
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■ Remove a key froze the list. 

■ Find a key in the list and retrieve its information. 

■ Find a key in the list and change its information. 

For all of the functions except adding a key to the list, the handle of the key is preferably 
5 used as an identifier in carrying out the function. As in any case of service hooking, the 

emulation function returns to the application the same range of return codes as the original VMM 
service would. Thus, the application is substantially unaware of and unaffected by the 
emulation. The above-mentioned Microsoft Platform SDK documentation lists the possible 
return codes for each registry-related service. Appendix A provides a brief description and 
10 pseudocode listing for all of the hooked services that are provided by the registry emulation 
functions. 

The emulation functions continue to carry out steps 78 through 82 for each registry 
service request that is received while the application is running. When the application is finished 
running, emulation registry database 52 is saved to hive file 40, including any changes made in 
15 the data while the application was running. When computer 21 again asks to run application 38, 
the stored data in the hive file are preferably reloaded, so that the changes made previously are 
restored. 

Fig. 4 is a flow chart that schematically illustrates a method for creating hive file 40, in 
accordance with a preferred embodiment of the present invention. This method is based on 
20 "spying" on a trial computer, such as computer 2 1 , during installation of application 3 8 on the 
computer. The normal installation procedure is used while a spy process monitors information 
written to the registry, in order to collect the keys and values needed for inclusion in emulation 
registry database 52. 

Installation of the application is begun at an initial step 90. During installation, the spy 
25 process intercepts all requests by the application (or by an installer utility associated with the 

application) to write to the registry of the computer, at a request hooking step 92. The hooking is 
preferably accomplished in substantially the same manner as at step 78 in the method of Fig. 3, 
using the above-mentioned Hook_Device_Service__C service, for example. In this case, the 
following VMM services must be hooked: 
30 ■ RegOpenKey 

■ RegCloseKey 

■ RegCreateKey 

■ RegSetValue 
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■ RegSetValueEx 

As an alternative to hooking these services, it is possible simply to monitor and record registry 
accesses by the application or its installer, using a utility such as Regmon (a shareware program 
available at http://www.sysinternals.com/regmon.htm). The information thus obtained can then 
5 be used to manually construct the emulation registry, using Regedit, for example. 

Each of the hooked requests at step 92 includes a specification of a key, as required by 
the syntax of the request. The operating system responds to these requests by providing the 
handle corresponding to the key. Using these keys and their handles, the spy process builds a 
key list for the application, similar to the key list that is later used at step 80 in the emulation 

10 method of Fig. 3. Thus, each hooked request is examined, at a key finding step 94, to determine 
whether the key already exists in the key list. If the process finds, at a new key step 96, that the 
key is not yet on the list, then the key path and handle are captured, in a get key step 98. This 
information is added to the key list, in an add key step 100. 

Using the key provided in the hooked request, the spy process services the request (taking 

15 the place of the VMM), at a request servicing step 102. Appendix B provides a brief description 
and pseudocode listing for each of the hooked services that is provided by the spy process. To 
save the registry data gathered at this stage, the process creates an emulation branch in the 
registry, exemplified by the branch under emulation subkey 54 in database 52. Then, at a data 
writing step 104, all of the registry data generated during the installation are written twice: once 

20 to the location intended by the application itself, and once to a mirror location in the emulation 
branch. For example, RMAT vendor key 60 will be written both to 
HKEY_LOCAL_MACHINE\SOFTWARE\RMAT and to 
HKEY_LOCAL_MACH^ 

SOFTWARE\RMAT. The installation thus proceeds transparently, without the application or 
25 installer being aware of the spy process going on. Once installation of the application is 

finished, the emulation branch of the registry is saved to hive file 40, at a file saving step 106, 

preferably by using the appropriate RegSaveKey command. 

The software required to carry out the functions described hereinabove, such as registry 

emulation, creating emulation hive files, and running applications without installation, is 
30 typically conveyed to computer 21 and/or server 32 in electronic form, over network 30, for 

example. Alternatively, some or all of the software may be supplied on tangible media, such as 

CD-ROM or nonvolatile memory. 
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Although preferred embodiments are described herein with reference to system 20, 
shown in Fig. 1 as a clientserver system operating over network 30, the usefulness of registry 
emulation is in no way limited to such systems. Registry emulation may also be used locally on 
computer 21, for example, to run applications off a medium such as a CD-ROM while saving the 
5 time needed for installation on the computer. Running applications without installation also 
avoids cluttering of local registry 26 with excessive application data. Furthermore, although the 
embodiments described herein are based on the registry of the Windows operating system, the 
principles of the present invention are similarly applicable to other operating systems that use a 
common database to maintain consistent configuration data for different applications. 

10 It will thus be appreciated that the preferred embodiments described above are cited by 

way of example, and that the present invention is not limited to what has been particularly shown 
and described hereinabove. Rather, the scope of the present invention includes both 
combinations and subcombinations of the various features described hereinabove, as well as 
variations and modifications thereof which would occur to persons skilled in the art upon reading 

15 the foregoing description and which are not disclosed in the prior art. 

APPENDIX A - HOOKED EMULATION SERVICES 
This appendix provides a brief description of each of the hooked services provided by the 
registry emulation process of Fig. 3, followed by a pseudocode listing of the function for 
emulation of the service. 
20 RegQpenKev 

This service accepts the handle of an already open registry key and the path to a subkey. 
The service attempts to open a new key under the existing- key using the given path. If 
successful, a new handle is assigned to the newly-opened registry key. 
1 . Find the key in the key list 
25 2. If the key was not found, call the original handler; exit 

3. If the information from the key list indicates that this key is a pure emulation key, use the 
original handler to open a new key using the given path; if successful add the new key to 
the key list, mark it as a pure emulation key; exit 

4. Use the original handler to open the required path. 
30 5. If successful add the new key to the list (it is not a 

pure emulation key); exit 

6. Use the original handler to open the required path in the emulation data 
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7. If successful add the new key to the key list, mark it as a pure emulation key; exit 

8. Return the error code from the original handler and exit 

RegCIoseKev 

This service accepts the handle of an already-open registry key and closes it. 
5 1. Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3. Call the original handler to close the handle 

4. Remove the key from the list 

RegQuervValue 

1 0 This service accepts the handle of an already-open registry key and the name of an 

existing subkey. It returns a string from the default value of the specified subkey. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3. If the key is a pure emulation key, call the original handler; exit 

1 5 4. Attempt to open the key in the emulation registry; the result is the emulation key 

5. If unsuccessful, call the original handler; return any result from the original handler 
(success or failure); exit 

6. Use the original handler and the emulation key to get the value from the emulation 
registry; if successful, return the result and exit 

20 7. Call the original handler; return any result from the original handler (success or failure); 
exit 

RegOuervValueEx 

This service accepts the handle of an already-open registry key and the name of an 
existing value. It returns the type, content, and size of the value. 
25 1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3. If the key is a pure emulation key, call the original handler; exit 

4. Attempt to open the key in the emulation registry, the result is the emulation key 

5. If unsuccessful, call the original handler; return any result from the original handler 
30 (success or failure); exit 
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6. Use the original handler and the emulation key to get the value from the emulation 
registry; if successful, return the result and exit 

7. Call the original handler; return any result from the original handler (success or failure); 
exit 

5 RegCreateKev 

This service accepts the handle of an already-open registry key and the path to a new 
subkey. It creates the new subkey. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

10 3. If the key is a pure emulation key, call the original handler; if successful, add the 
newly-created key to the key list as a pure emulation key; exit 

4. Attempt to open (do not create yet) the new key in the real registry; if successful, add the 
new key to the list (not a pure emulation key); exit 

5 . Open the existing key in the emulation registry 

15 6. If unsuccessful, create the existing key in the emulation registry 

7. Create the new key in the emulation registry 

8. Add the newly-created key to the key list as a pure emulation key; exit 

RegSetValue 

This service accepts the handle of an already-open registry key, the name of a new 
20 subkey and a string value. It creates the subkey under the existing key and sets its default value 
to the given string. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3. If the key is a pure emulation key, call the original handler; exit 
25 4. Open the path to the key in the emulation registry 

5. If unsuccessful, create the existing key in the emulation registry 

6. Call the original handler to set the value under the newly-opened/created key in the 
emulation registry 

7. Return the result of the original handler and exit 



30 



RegSetValueEx 
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This service accepts the handle of an already-open registry key, along with the name of a 
value and its type, size and content. It sets the value accordingly, after first creating it if 
necessary. 

1 . Find the key in the key list 

5 2. If the key was not found, call the original handler; exit 

3. If the key is a pure emulation key, call the original handler; exit 

4. Open the path to the key in the emulation registry 

5. If unsuccessful, create the existing key in the emulation registry 

6. Call the original handler to set the value under the newly-opened/created key in the 
10 emulation registry 

7. Return the result of the original handler and exit 

RegEnumKev 

This service accepts the handle of an already-open registry key and an enumeration 
index, and returns an enumeration of the subkeys under the existing key. 
15 1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3. It the key is a pure emulation key, call the original handler; exit 

4. It the key does not have a parallel key in the list, skip to step 9 below 

5. Call the original handler to perform the enumeration; if successful, return the result and 
20 exit 

6. If the original handler failed with any error code other than 
ERROR JsfOJVIOREJTEMS, return the error code and exit 

7. Calculate a new enumeration index by subtracting the enumeration index from the 
maximum key index 

25 8. Call the original handler with the parallel key and the new enumeration index; return the 
result and exit 

9. Call the original handler to perform the enumeration; if successful, return the result and 
exit 

10. If the original handler failed with any error code other than 
30 ERROR JSTO_MORE_ITEMS , return the error code and exit 

1 1 . Open the path to the key in the emulation registry 

12. If unsuccessful, exit with the code ERROR JNFO_MORE_ITEMS 
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13. The key opened in step 1 1 is now the parallel key, store it in the key list 

14. The enumeration index is now the maximum key index; store it in the key list 

15. Call the original handler with the parallel key and enumeration index 0; return the result 
and exit 

5 RegEnumValue 

This service accepts the handle of an already-open registry key and an enumeration 
index, and returns an enumeration of the values under the existing key. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

10 3 . If the key is a pure emulation key, call the original handler; exit 

4. If the key does not have a parallel key in the list, skip to step 9 below 

5. Call the original handler to perform the enumeration; if successful, return the result and 
exit 

6. If the original handler failed with any error code other than 

1 5 ERROR_NO JVfORE JTEMS, return the error code and exit 

7. Calculate a new enumeration index by subtracting the enumeration index from the 
maximum value index 

8. Call the original handler with the parallel key and the new enumeration index; return the 
result and exit 

20 9. Call the original handler to perform the enumeration; if successful, return the result and 
exit 

1 0. If the original handler failed with any error code other than 
ERROR_NO_MORE JTEMS, return the error code and exit 

1 1 . Open the path to the key in the emulation registry 

25 12. If unsuccessful, exit with the code ERROR_NO JVIORE JTCEMS 

1 3 . The key opened in line 1 1 is now the parallel key; store it in the key list 

14. The enumeration index is now the maximum value index; store it in the key list 

1 5 . Call the original handler with the parallel key and enumeration index 0; return the result 
and exit 

30 RegQuervInfoKev 

This service accepts the handle of an already-open registry key and an enumeration 
index, and returns information about the key. 
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1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3. If the key is a pure emulation key, call the original handler; exit 

4. Call the original handler; if unsuccessful, return the error code and exit 

5. Open the path to the key in the emulation registry 

6. If unsuccessful, return the results of the call in step 4; exit 

7. Use the key opened in step 5, and call the original handler 

8. Calculate the combined results for the following parameters: IpcSubKeys, 
IpechMaxSubKey, lpc Values, lpcchMaxValueName, lpcbMaxValueData (as specified in 
the Platform SDK documentation); for each parameter in the list calculate the maximum 
of the two results (from steps 4 and 7) 

9. Close the key opened in step 5 

10. Return the combined results (as calculated in line 8) and exit 

APPENDIX B - HOOKED "SPY 11 SERVICES 

This appendix provides a brief description of each of the hooked services provided by the 
spy process of Fig. 4, followed by a pseudocode listing of the function for emulation of the 
service. Although the spy process hooks some of the same VMM services as the emulation 
process, it responds to them differently, as detailed below. 

RegOpenKev 

This service accepts the handle of an already-open registry key and the path to a subkey. 
The service attempts to open a new key under the existing key using the given path. If 
successful, a new handle is assigned to the newly open registry key. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3 . Use the original handler to open the required path 

4. If successful, add the new key to the list 

5. Return the error code from the original handler and exit 

RegCloseKev 

This service accepts the handle of an already-open registry key and closes it. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 
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3 . Call the original handler to close the handle 

4. Remove the key from the list 

ReqCreateKev 

This service accepts the handle of an already-open registry key and the path to a new 
5 subkey. It creates the new subkey. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3 . Call the original handler to create the new key 

4. Add the newly created key to the key list 
10 5. Exit 

RegSetValue 

This service accepts the handle of an already-open registry key, the name of a new 
subkey and a string value. It creates the subkey under the existing key and sets its default value 
to the given string. 
15 L Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3 . Open the path to the key in the emulation branch 

4. If unsuccessful, create the existing key in the emulation branch 

5. Call the original handler to set the value under the newly-opened/created key in the 
20 emulation branch 

6. Call the original handler again to set the value, this time under the original existing key 

7. Return the result of the call in step 6 and exit 

RegSetValueEx 

This service accepts the handle of an already-open registry key, the name of a value, and 
25 the type, size and the content of the value. It sets the value accordingly, creating it if necessary. 

1 . Find the key in the key list 

2. If the key was not found, call the original handler; exit 

3 . Open the path to the key in the emulation branch 

4. If unsuccessful, create the existing key in the emulation branch 

30 5. Call the original handler to set the value under the newly-opened/created key in the 
emulation branch 
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6. Call the original handier again to set the value, this time under the original existing key 

7. Return the result of the call in step 6 and exit 
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CLAIMS 

11. A method for running a software application on a computer having an operating system 

2 that provides a local database containing consistent configuration data to be accessed by 

3 programs running on the computer, the method comprising: 

4 providing a file containing further configuration data required by the application, 

5 which further data are not stored in the local database; 

6 intercepting a request by the application to access the local database; and 

7 returning an item of the further configuration data from the file to the application, 

8 responsive to the request. 

12. A method according to claim 1 , wherein the database comprises a hierarchical database 

2 having a tree structure that comprises a plurality of branches, and wherein providing the file 

3 comprises providing data corresponding to one or more branches of the tree structure that are 

4 used by the application. 

13. A method according to claim 2, wherein the operating system comprises a Windows 

2 operating system, and the database comprises a Windows registry, and wherein providing the 

3 data comprises providing one or more registry keys. 

14. A method according to claim 3, wherein intercepting the request comprises hooking a 
2 registry service request. 

1 5. A method according to claim 4, wherein hooking the registry service request comprises 

2 identifying one of the keys in the request, and processing the request responsive to the identified 

3 key. 

1 6. A method according to claim 3, wherein providing the file comprises providing a hive 

2 file, and loading the data from the file into the registry before running the application. 

1 7. A method according to claim 2, wherein intercepting the request comprises making a 

2 determination whether the request relates to one of the branches that contains only the further 

3 configuration data, or whether the request relates to another of the branches that is shared with 

4 the database, and processing the request responsive to the determination. 
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18. A method according to claim 1, wherein intercepting the request by the application 

2 comprises receiving a request to alter the further configuration data, and comprising altering the 

3 data in the file responsive to the request. 

19. A method according to claim 8, and comprising saving the file including the altered data 
2 upon termination of the application, to be used in running the application subsequently. 

1 10. A method according to claim 1 , wherein returning the item of the further configuration 

2 data comprises emulating access by the operating system to the database, so that the request is 

3 handled in a manner transparent to the application. 

1 11. A method according to claim 1, wherein the further configuration data comprise data that 

2 would normally be written to the database in the course of installation of the application on the 

3 computer, and wherein running the software application comprises running the application 

4 substantially without installation on the computer, by using the data in the file. 

1 12. A method for running a software application on a computer without installation of the 

2 application thereon, under an operating system that provides a local database containing 

3 consistent configuration data to be accessed by programs running on the computer, which 

4 configuration data would normally include installation data generated during the installation of 

5 the application, the method comprising: 

6 providing a file containing the installation data, which are not stored in the local 

7 database; and 

8 accessing the data in the file instead of accessing the local database so as to retrieve the 

9 installation data while running the application. 

1 13. A method according to claim 12, and comprising receiving the file and the application by 

2 download over a network to run on the computer. 

1 14. A method according to claim 12, wherein accessing the data comprises providing the 

2 installation data from the file in a manner that emulates access by the operating system to the 

3 database, whereby the data are accessed in a manner transparent to the application. 
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1 15. A method according to claim 12, wherein the operating system comprises a Windows 

2 operating system, and the database comprises a Windows registry, and wherein providing the file 

3 comprises providing a hive file. 

1 16. A method according to claim 12, wherein providing the file comprises collecting the 

2 installation data responsive to installing the application on a trial computer. 

1 17. A method for generating an emulation file for use in running a software application on a 

2 user computer under an operating system that provides a local database containing consistent 

3 configuration data to be accessed by programs running on the user computer, which 

4 configuration data would normally include installation data generated during installation of the 

5 application on the user computer, the method comprising: 

6 installing the application on a trial computer; 

7 intercepting a request generated while installing the application to write the installation 

8 data to the database on the trial computer; and 

9 responsive to the intercepted request, writing the installation data to the emulation file, to 

10 be accessed by the application running on the user computer in place of accessing the local 

1 1 database, whereby the application runs on the user computer without installation thereon. 

1 18. A method according to claim 1 7, wherein the operating system comprises a Windows 

2 operating system, and the database comprises a Windows registry, and wherein intercepting the 

3 request comprises hooking a registry service request. 

1 19. A method according to claim 1 8, wherein writing the installation data comprises saving 

2 one or more registry keys in a hive file. 

1 20. A method according to claim 1 9, wherein saving the one or more registry keys in the hive 

2 file comprises creating an emulation branch in the registry that mirrors locations at which the one 

3 or more keys are stored in the registry during the installation on the trial computer, and saving 

4 the emulation branch in the hive file. 

1 21. Computer apparatus having an operating system that provides a local database containing 

2 consistent configuration data to be accessed by programs running on the apparatus, which 

3 apparatus is adapted to receive a file containing further configuration data required by an 

4 application, which further data are not stored in the local database, and to run an application 
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5 under the operating system by intercepting requests made by the application to access the 

6 database and to return, responsive to the requests, items of the further configuration data from 

7 the file to the application. 

1 22. Apparatus according to claim 2 1 , wherein the operating system comprises a Windows 

2 operating system, and the database comprises a Windows registry, and wherein the further 

3 configuration data comprise registry keys. 

1 23 . Apparatus according to claim 2 1 , wherein the further configuration data comprise data 

2 that would normally be written to the database in the course of installation of the application on 

3 the computer apparatus, and wherein the apparatus is adapted to run the application substantially 

4 without installation, by using the data in the file. 

1 24. Computer apparatus for running a software application under an operating system that 

2 provides a local database containing consistent configuration data to be accessed by programs 

3 running on the computer, which configuration data would normally include installation data 

4 generated during installation of the application on the apparatus, which apparatus is adapted to 

5 receive a file containing the installation data, which are not stored in the local database, and to 

6 run the application without the installation of the application on the apparatus by retrieving the 

7 installation data from the file instead of accessing the local database. 

1 25. Apparatus according to claim 24, which is coupled to receive the file and the application 

2 by download over a network to run on the apparatus. 

1 26. Apparatus according to claim 24, wherein the operating system comprises a Windows 

2 operating system, and the database comprises a Windows registry, and wherein the file 

3 comprises a hive file. 

1 27. Apparatus for generating an emulation file for use in running a software application on a 

2 user computer under an operating system that provides a local database containing consistent 

3 configuration data to be accessed by programs running on the user computer, which 

4 configuration data would normally include installation data generated during installation of the 

5 application on the computer, the apparatus comprising a trial computer on which the application 

6 is installed, which trial computer is adapted to intercept requests, generated while installing the 

7 application, to write the installation data to the local database on the trial computer, and which 
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8 trial computer is further adapted, responsive to the intercepted requests, to write the installation 

9 data to the emulation file, to be accessed by the application running on the user computer in 

10 place of accessing the local database, whereby the application runs on the user computer without 

1 1 installation thereon, 

1 28. A computer software product for enabling a software application to run on a computer 

2 having an operating system that provides a local database containing consistent configuration 

3 data to be accessed by programs running on the computer, the product comprising a computer- 

4 readable medium in which program instructions are stored, which instructions, when read by the 

5 computer, cause the computer to receive a file containing further configuration data required by 

6 the application, which further data are not stored in the local database, and to intercept a request 

7 by the application to access the local database, so as to return an item of the further configuration 

8 data to the application, responsive to the request. 

1 29. A product according to claim 28, wherein the operating system comprises a Windows 

2 operating system, and the database comprises a Windows registry, and wherein the request 

3 intercepted by the computer comprises a registry service request, which is hooked by the 

4 computer so as to identify one of the keys in the request and to process the request responsive to 

5 the identified key. 

1 30. A computer software product for enabling a software application to run on a computer 

2 without installation of the application on the computer, under an operating system that provides 

3 a local database containing consistent configuration data to be accessed by programs running on 

4 the computer, which configuration data would normally include installation data generated 

5 during the installation of the application on the computer, the product comprising a 

6 computer-readable medium in which program instructions are stored, which instructions, when 

7 read by the computer, cause the computer to read a file containing the installation data, ^hich 

8 installation data are not stored in the database, and to access the data in the file instead of 

9 accessing the local database so as to retrieve the installation data while running the application. 

1 31. A product according to claim 30, wherein the operating system comprises a Windows 

2 operating system, and the database comprises a Windows registry, and wherein the file read by 

3 the computer comprises a hive file. 
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1 32. A computer software product for generating an emulation file for use in running a 

2 software application on a user computer under an operating system that provides a local database 

3 containing consistent configuration data to be accessed by programs running under the operating 

4 system, which configuration data would normally include installation data generated during 

5 installation of the application, the product comprising a computer-readable medium in which 

6 program instructions are stored, which instructions, when read by a trial computer, cause the trial 

7 computer to intercept a request generated to write the installation data to the database while the 

8 application is being installed on the trial computer, and responsive to the intercepted request, to 

9 write the installation data to the emulation file, to be accessed by the application running on the 

10 user computer instead of accessing the local database, whereby the application runs on the 

1 1 user computer without installation thereon. 
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